Romel Duroseau

Where your proof lands

Derived from what each verified ledger entry actually covers. You have nothing in forensics & dfir, cloud & containers.

• Networks & protocols2,022
  Evidence

  A compromised test host in the user VLAN can open outbound TCP connections to arbitrary in

  A perimeter scan finds TCP 445 reachable from the internet on a file server that also acce

  A host can ping a server but cannot connect to its TCP 8080 service. What should you check

  Two hosts suddenly report the gateway IP at a new MAC address; packet capture shows repeat

  The office can reach IP addresses but every hostname fails. Your packet capture shows unan

  A cashier terminal knows the gateway's IPv4 address but needs its local hardware address b

  OSCP+

  eCXD

  PWPA

  eWPT

  eCPPTv2

  eJPT

  A workstation sends hundreds of long, unique TXT queries under one domain every 30 seconds

  A Windows file share is reachable on TCP 445. Which protocol are you looking at?

  First night on a hospital SOC: a scan shows TCP 443 open on the patient portal. Which serv

  CWES

  CPTS

  PNPT

  PWPP

  PWPE

  OSCP

  1ngridJoh4nsen
• Web & AppSec545
  Evidence

  An API accepts a JWT whose header was changed from RS256 to HS256 and signed with the publ

  POST /account/email changes the logged-in user's email using only a session cookie; a cros

  OSCP+

  A PDF preview endpoint accepts a URL. Supplying http://169.254.169.254/latest/meta-data/ c

  A comment containing `<script>alert(1)</script>` runs for every visitor. What is the bug?

  The search route parameterises q but concatenates sort directly into `ORDER BY ${sort}`. A

  During an authorised pentest, GET /api/invoices/184 returns your invoice. Changing 184 to

  An image-from-URL feature can fetch http://127.0.0.1/admin from the server. What is this?

  Adding a single quote to a product ID changes the response to a SQL syntax error. What sho

  A page on another site can submit a form that changes your email while you are logged in.

  You change /users/41 to /users/42 and see another user's profile. What is this?

  OSCP
• Active Directory496
  Evidence

  BloodHound shows Helpdesk-L1 has GenericAll over the Server Admins group, although the tea

  A legacy application server is marked TRUSTED_FOR_DELEGATION and domain administrators per

  A backup operators group unexpectedly holds Replicating Directory Changes and Replicating

  A typo in a network path makes Windows ask the local network for the name and an attacker

  A user opens the payroll share without typing a second password. In the trace, the domain

  At 08:55 every employee in a branch loses domain login. One Windows server holds the direc

  CPTS

  PNPT

  1ngridJoh4nsen
• Code & tooling182
  Evidence

  A Python worker loads a base64 job field with pickle.loads; jobs can be submitted by ordin

  A Node route executes `exec('ping -c 1 ' + req.body.host)` after checking only that host i

  The avatar endpoint reads `/images/` plus a filename. One request tries to escape the gall

  The build requests `company-auth` without a registry scope; the name is absent publicly an

  On authentication failure, middleware logs the complete request headers, including Authori

  A server runs `eval()` on a value from the request body. What is the danger?

  A download handler joins `/srv/reports` with a user filename after replacing the first `..

  During a fintech code review, you spot a search box concatenated directly into SQL. Which

  Code builds `ping ` + userInput and passes it to a shell. What is the main risk?

  A CI log reveals a production API key copied from `config.ts`. The team asks where that ke

  m1llenn1um
• Recon & OSINT82
  Evidence

  Public tender PDFs list internal usernames, software versions and an author naming convent

  Certificate history and passive DNS reveal origin-old.example.com on an address in the com

  A mobile app references assets-prod-company.s3.amazonaws.com; anonymous listing is denied

  A scoped staging host returns 200 for /.git/HEAD and exposes refs, while directory listing

  You want subdomains without sending traffic to the target. Which approach fits?

  A look-alike domain appeared hours before a phishing wave. Without touching its server, wh

  docs.example.com is a CNAME to an unclaimed third-party site identifier; the vendor return

  robots.txt lists /admin-old. Does that make the path private?

  You discover a company subdomain during a bounty. Can you test it immediately?

  A web root exposes /.git/. What could an attacker recover?
• Cryptography42
  Evidence

  Encrypted profile cookies contain repeated 16-byte ciphertext blocks whenever repeated rol

  An API validates webhook HMACs with a loop that returns immediately at the first mismatchi

  A game studio mirrors an installer after a supply-chain scare. Before launching it, you ne
• Forensics & DFIRno proof yet
• Cloud & containersno proof yet

Everything below is priced. Pick the cheapest one and the gap closes.

1. Claim a CVE

   Any published advisory with your name on the credit line.

   +260

   points
   41% of the gap
2. Connect TryHackMe

   Points and completed rooms.

   +180

   points
   29% of the gap
3. Clear another lab

   62 lab entries scored. 1,488 points left before the lab ceiling.

   +60

   points
   10% of the gap
4. Publish a write-up

   Explain the bug, impact and fix. Peer-reviewed write-ups score after approval.

   +180

   points
   29% of the gap
5. Submit a vulnerability report

   A confirmed low, medium, high or critical report is the cleanest path up the ladder.

   +160

   points
   25% of the gap
6. Own 10 more machines

   Each user or system own is worth 4 points, and rank bonuses compound.

   +40

   points
   6% of the gap